KC-3 — Chapter 3 Knowledge Check
Questions and answer context for Chapter 3
Use this page after completing the chapter Knowledge Check. Each question is repeated so the answer and rationale retain their full instructional context.
Questions
Select the best answer for each question.
1. Why does the Ubuntu sensor in this laboratory use two network interfaces?
A. To separate management traffic from dedicated packet-capture traffic
B. To increase Internet download speed
C. Because Wazuh requires two interfaces to install
D. To allow dual-booting
2. Which VMware network mode is most commonly used for cybersecurity laboratories that need realistic network visibility?
A. NAT
B. Host-Only
C. Bridged
D. Airplane mode
3. What is the primary purpose of a VMware snapshot?
A. To increase virtual machine performance
B. To provide a recovery point before making changes
C. To back up files to the cloud
D. To install new software automatically
4. Where does Suricata write its structured alert and event data by default?
A. /var/log/wazuh.json
B. /etc/suricata/suricata.yaml
C. /var/ossec/logs/ossec.log
D. /var/log/suricata/eve.json
5. What must be true before Suricata can detect a given packet?
A. The packet must be encrypted
B. The Wazuh Manager must request it
C. The packet must actually reach the monitored interface
D. The packet must originate from the Internet
6. What is the purpose of the Emerging Threats Open rule set?
A. It provides community-maintained detection signatures for Suricata
B. It replaces the Wazuh Manager
C. It encrypts agent-to-manager communication
D. It is a replacement for VMware networking
7. Where should custom, locally developed Suricata signatures be stored?
A. Inside the ET Open rule files directly
B. In suricata.yaml
C. In the Wazuh Manager configuration
D. In a separate local.rules file
8. Which command validates Suricata’s configuration file syntax before restarting the service?
A. suricata-update
B. suricata -T -c /etc/suricata/suricata.yaml
C. systemctl enable suricata
D. tail -f eve.json
9. If no Suricata alerts appear in the Wazuh Dashboard after a scan, what should be verified first?
A. Whether the Wazuh Dashboard theme is set correctly
B. Whether the scan was run twice
C. Whether the complete telemetry pipeline — packet, interface, Suricata, eve.json, Agent, Manager, Indexer, Dashboard — is intact
D. Whether Windows Defender is enabled
10. What is the recommended workflow before performing a major software installation in this lab?
A. Take a snapshot, then install, configure, and validate
B. Install first, document later
C. Disable all logging to improve performance
D. Skip validation to save time
Answer Key
| Q | Answer | Why |
|---|---|---|
| 1 | A | One NIC manages the VM; the second captures mirrored traffic promiscuously. |
| 2 | C | Bridged mode places VMs on the physical network for realistic visibility. |
| 3 | B | Snapshots provide a recovery point before risky changes. |
| 4 | D | Suricata writes structured events to /var/log/suricata/eve.json. |
| 5 | C | Suricata can only inspect packets that reach its monitored interface. |
| 6 | A | ET Open supplies community-maintained Suricata signatures. |
| 7 | D | Custom signatures belong in a separate local.rules file. |
| 8 | B | suricata -T -c /etc/suricata/suricata.yaml validates configuration syntax. |
| 9 | C | Verify the full pipeline: packet → interface → Suricata → eve.json → Agent → Manager → Indexer → Dashboard. |
| 10 | A | Snapshot first, then install, configure, and validate. |